@intentius/chant-lexicon-terraform 0.101.0 → 0.102.0

package/dist/lint/post-synth/tf036.d.ts

@@ -0,0 +1,33 @@
+/**
+ * TF036: an EBS volume does not ask for encryption (chant #2288, epic #2284).
+ *
+ * The Terraform counterpart of the aws lexicon's WAW028, written natively.
+ *
+ * Absence is not determined for this resource. `aws_ebs_volume.encrypted` is
+ * optional, computed and force-new (provider `internal/service/ec2/
+ * ebs_volume.go`, v6.67.0). Whether a volume created without it is encrypted
+ * depends on the Region's EBS encryption by default
+ * (https://docs.aws.amazon.com/ebs/latest/userguide/encryption-by-default.html),
+ * which is account state the parse cannot see, and a volume built from
+ * `snapshot_id` also follows its snapshot. So an unset `encrypted` emits one
+ * `info` diagnostic, not a finding.
+ *
+ * One configuration does settle absence: the volume `depends_on` an
+ * `aws_ebs_encryption_by_default` in the same module whose `enabled` is
+ * absent (the provider default is `true`) or literal `true`, on the same
+ * `provider` and `region`. The `depends_on` matters: without it Terraform may
+ * create the volume before it turns the default on, and the default "has no
+ * effect on existing EBS volumes".
+ *
+ * `encrypted = false` is a finding even though encryption by default would
+ * override it. The literal is wrong either way: with the default off the
+ * volume is unencrypted, and with it on AWS encrypts the volume anyway ("you
+ * cannot disable it for individual volumes"), the volume no longer matches
+ * the configuration, and because `encrypted` forces replacement Terraform
+ * plans to replace it on every apply.
+ *
+ * Scope: root and child modules alike (#2112).
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf036: PostSynthCheck;
+//# sourceMappingURL=tf036.d.ts.map

package/dist/lint/post-synth/tf036.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf036.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf036.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AA0B9G,eAAO,MAAM,KAAK,EAAE,cA6DnB,CAAC"}

package/dist/lint/post-synth/tf037.d.ts

@@ -0,0 +1,31 @@
+/**
+ * TF037: an ECR repository lets an image tag be repointed (chant #2288, epic
+ * #2284).
+ *
+ * The Terraform counterpart of the aws lexicon's WAW054, written natively.
+ *
+ * Absence is insecure for this resource, and the rule reports it.
+ * `aws_ecr_repository.image_tag_mutability` (provider
+ * `internal/service/ecr/repository.go`, v6.67.0) is optional with
+ * `Default: MUTABLE`, so a repository that does not set it lets anyone with
+ * push access move a tag (`prod`, `v1.4.2`) to different image content after
+ * it was deployed, scanned or signed.
+ *
+ * Provider v6 accepts four values (AWS added the two `_WITH_EXCLUSION` modes
+ * in 2025), and the rule reads them as follows:
+ *
+ * - `IMMUTABLE`: secure.
+ * - `IMMUTABLE_WITH_EXCLUSION`: secure. Tags matching an
+ *   `image_tag_mutability_exclusion_filter` stay mutable, a written-down
+ *   exception such as `latest`. A filter that is nothing but `*` excludes
+ *   every tag, so it is a finding; a filter from an expression is not
+ *   determined.
+ * - `MUTABLE`, absent, and `MUTABLE_WITH_EXCLUSION` (every tag mutable except
+ *   those the filters name): a finding.
+ * - an expression: not determined.
+ *
+ * Scope: root and child modules alike (#2112).
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf037: PostSynthCheck;
+//# sourceMappingURL=tf037.d.ts.map

package/dist/lint/post-synth/tf037.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf037.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf037.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAmC9G,eAAO,MAAM,KAAK,EAAE,cAoCnB,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "terraform",
-  "version": "0.101.0",
+  "version": "0.102.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Terraform"
 }

package/dist/okf/index.md

@@ -32,4 +32,12 @@ okf_version: '0.2'
 * [TF027](/rules/TF027.md) - Live root's policy block sets undeclared_untagged = "delete", which deletes resources chant does not own
 * [TF028](/rules/TF028.md) - A live root is watched by a TerraformWatchOp built without live: true
 * [TF029](/rules/TF029.md) - Live root names its estate both in chant.config and in its own HCL
+* [TF030](/rules/TF030.md) - Security group rule allows unrestricted ingress on a sensitive port
+* [TF031](/rules/TF031.md) - IAM policy allows a wildcard Action or Resource
+* [TF032](/rules/TF032.md) - ECS container definition passes a credential as a plaintext environment value
+* [TF033](/rules/TF033.md) - RDS DB instance or cluster storage is not encrypted
+* [TF034](/rules/TF034.md) - SNS topic has no server-side encryption
+* [TF035](/rules/TF035.md) - SQS queue turns server-side encryption off
+* [TF036](/rules/TF036.md) - EBS volume does not ask for encryption
+* [TF037](/rules/TF037.md) - ECR repository allows mutable image tags
 * [TF101](/rules/TF101.md) - terraformApply's planFile must reference a preceding terraformPlan step.

package/dist/okf/rules/TF030.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF030
+description: Security group rule allows unrestricted ingress on a sensitive port
+id: TF030
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Security group rule allows unrestricted ingress on a sensitive port

package/dist/okf/rules/TF031.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF031
+description: IAM policy allows a wildcard Action or Resource
+id: TF031
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+IAM policy allows a wildcard Action or Resource

package/dist/okf/rules/TF032.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF032
+description: ECS container definition passes a credential as a plaintext environment value
+id: TF032
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+ECS container definition passes a credential as a plaintext environment value

package/dist/okf/rules/TF033.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF033
+description: RDS DB instance or cluster storage is not encrypted
+id: TF033
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+RDS DB instance or cluster storage is not encrypted

package/dist/okf/rules/TF034.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF034
+description: SNS topic has no server-side encryption
+id: TF034
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+SNS topic has no server-side encryption

package/dist/okf/rules/TF035.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF035
+description: SQS queue turns server-side encryption off
+id: TF035
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+SQS queue turns server-side encryption off

package/dist/okf/rules/TF036.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF036
+description: EBS volume does not ask for encryption
+id: TF036
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+EBS volume does not ask for encryption

package/dist/okf/rules/TF037.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF037
+description: ECR repository allows mutable image tags
+id: TF037
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+ECR repository allows mutable image tags

package/dist/op/activity-contracts.d.ts

@@ -31,60 +31,63 @@
  */
 export declare const terraformInitContract: import("@intentius/chant/op").ActivityContract<{
     root: string;
+    cwd?: string | undefined;
     upgrade?: boolean | undefined;
     reconfigure?: boolean | undefined;
-    cwd?: string | undefined;
 }, {
     dir: string;
     workspace?: string | undefined;
 }>;
 export declare const terraformPlanContract: import("@intentius/chant/op").ActivityContract<{
     root: string;
+    cwd?: string | undefined;
     planFile?: string | undefined;
     destroy?: boolean | undefined;
-    cwd?: string | undefined;
 }, {
+    adds: number;
+    changes: number;
+    destroys: number;
     changed: boolean;
     planFile: string;
     dir: string;
     json: unknown;
     text: string;
     planDigest: string;
-    adds: number;
-    changes: number;
-    destroys: number;
 }>;
 export declare const terraformApplyContract: import("@intentius/chant/op").ActivityContract<{
     root: string;
-    planFile?: string | undefined;
     cwd?: string | undefined;
+    planFile?: string | undefined;
 }, {
+    planFile?: string | undefined;
     dir: string;
     applied: boolean;
-    planFile?: string | undefined;
     refused?: "approval-mismatch" | "wrong-estate" | undefined;
     refusal?: string | undefined;
 }>;
 export declare const terraformShowContract: import("@intentius/chant/op").ActivityContract<{
     root: string;
-    planFile?: string | undefined;
     cwd?: string | undefined;
+    planFile?: string | undefined;
 }, {
+    adds: number;
+    changes: number;
+    destroys: number;
     source: "plan" | "state";
     json: unknown;
     text: string;
     dir: string;
-    adds: number;
-    changes: number;
-    destroys: number;
     planFile?: string | undefined;
 }>;
 export declare const choudoufuLivePlanContract: import("@intentius/chant/op").ActivityContract<{
     root: string;
+    cwd?: string | undefined;
     estate?: string | undefined;
     adoptionOnly?: boolean | undefined;
-    cwd?: string | undefined;
 }, {
+    adds: number;
+    changes: number;
+    destroys: number;
     unowned: number;
     adoptable: number;
     drift: boolean;
@@ -102,15 +105,12 @@ export declare const choudoufuLivePlanContract: import("@intentius/chant/op").Ac
     dir: string;
     documentPath: string;
     estate: string;
-    adds: number;
-    changes: number;
-    destroys: number;
 }>;
 export declare const choudoufuLiveLsContract: import("@intentius/chant/op").ActivityContract<{
     root: string;
+    cwd?: string | undefined;
     estate?: string | undefined;
     consistent?: boolean | undefined;
-    cwd?: string | undefined;
 }, {
     json: unknown;
     dir: string;
@@ -126,14 +126,14 @@ export declare const choudoufuLiveCheckContract: import("@intentius/chant/op").A
     dir: string;
 }>;
 export declare const choudoufuAdoptContract: import("@intentius/chant/op").ActivityContract<{
+    root: string;
+    cwd?: string | undefined;
     adoptions: {
         [x: string]: unknown;
     }[];
-    root: string;
     contested?: {
         [x: string]: unknown;
     }[] | undefined;
-    cwd?: string | undefined;
 }, {
     mechanism: "tag-write";
     adopted: string[];

package/dist/op/builders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/op/builders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EACnB,MAAM,wBAAwB,CAAC;AAEhC,kFAAkF;AAClF,KAAK,QAAQ,GAAG;IAAE,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAGF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAGF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GACzB,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC/D,iBAGF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAC5B,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAClE,iBAOF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,GAC1B,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAChE,iBAOF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KACnE,iBAOF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GACzB,MAAM,MAAM,EACZ,MAAM,YAAY,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAOF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAOF,CAAC"}
+{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/op/builders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EACnB,MAAM,wBAAwB,CAAC;AAEhC,kFAAkF;AAClF,KAAK,QAAQ,GAAG;IAAE,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,SAClB,MAAM,SACL,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAGF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,SAClB,MAAM,SACL,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAGF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,SACnB,MAAM,SACL,YAAY,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC/D,iBAGF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,SACtB,MAAM,SACL,YAAY,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAClE,iBAOF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,SACpB,MAAM,SACL,YAAY,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAChE,iBAOF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,SACvB,MAAM,SACL,YAAY,CAAC,IAAI,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KACnE,iBAOF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,SACnB,MAAM,QACN,YAAY,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAOF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,SAClB,MAAM,SACL,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAOF,CAAC"}

package/dist/rules/flat-attributes.ts

@@ -0,0 +1,146 @@
+/**
+ * Shared reading helpers for TF033-TF037, the five flat encryption and
+ * immutability rules (chant #2288, epic #2284).
+ *
+ * Each of those rules reads one or two scalar attributes of one resource type
+ * and answers a three-valued question: the literal proves the resource
+ * secure, the literal proves it insecure, or the parse cannot tell. This
+ * module is the reading half; each rule file holds its own answer for
+ * absence, because that answer differs per resource (see each rule's doc
+ * comment and its section of `docs/pages/lint-rules.mdx`). It exports no
+ * `PostSynthCheck`, so the generated barrel skips it.
+ */
+
+import type { PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { RESOURCE_TYPE, type BlockBody } from "../../hcl/parse";
+import { attr } from "../../hcl/value";
+import { blocksOfType, nestedBodies, type TerraformBlock } from "./blocks";
+
+/** What one attribute read settles. `reason` says why a value could not be read. */
+export type Read<T> = { kind: "known"; value: T } | { kind: "absent" } | { kind: "unknown"; reason: string };
+
+/** Every `resource` block of one provider type (`aws_sqs_queue`), in entity order. */
+export function resourcesOfType(ctx: PostSynthContext, type: string): TerraformBlock[] {
+  return blocksOfType(ctx, RESOURCE_TYPE).filter((b) => b.address.startsWith(`${type}.`));
+}
+
+/** One expression, for a message: `var.encrypted`, or the template text. */
+function describe(name: string, raw: unknown, refs: string[] | undefined, kind: "reference" | "template"): string {
+  return kind === "reference"
+    ? `\`${name}\` is an expression (${refs?.[0] ?? String(raw)})`
+    : `\`${name}\` is a template string ("${String(raw)}")`;
+}
+
+/**
+ * A bool attribute. Terraform converts the strings `"true"` and `"false"` to
+ * bool, so those read as the bool they convert to. Any other literal (a
+ * number, a list) is a plan-time type error, not this rule's concern, and
+ * reads as unknown.
+ */
+export function readBool(body: BlockBody, name: string): Read<boolean> {
+  const a = attr(body, name);
+  if (a.kind === "absent") return { kind: "absent" };
+  if (a.kind === "reference" || a.kind === "template") {
+    return { kind: "unknown", reason: describe(name, a.raw, a.refs, a.kind) };
+  }
+  if (typeof a.value === "boolean") return { kind: "known", value: a.value };
+  if (a.value === "true" || a.value === "false") return { kind: "known", value: a.value === "true" };
+  return { kind: "unknown", reason: `\`${name}\` is not a bool (${JSON.stringify(a.value)})` };
+}
+
+/** A string attribute, literal or not. */
+export function readString(body: BlockBody, name: string): Read<string> {
+  const a = attr(body, name);
+  if (a.kind === "absent") return { kind: "absent" };
+  if (a.kind === "reference" || a.kind === "template") {
+    return { kind: "unknown", reason: describe(name, a.raw, a.refs, a.kind) };
+  }
+  if (typeof a.value === "string") return { kind: "known", value: a.value };
+  return { kind: "unknown", reason: `\`${name}\` is not a string (${JSON.stringify(a.value)})` };
+}
+
+/** Expression roots that name an input or a computed value, not a managed object. */
+const VALUE_ROOTS = new Set(["var", "local", "module", "each", "count", "path", "terraform", "self"]);
+
+/** `aws_kms_key.sns.arn`, `data.aws_kms_alias.sqs.target_key_arn`, with an optional index or splat. */
+const OBJECT_ATTRIBUTE = /^(?:data\.)?([a-z][a-z0-9_]*)\.[A-Za-z_][\w-]*(?:\[[^\]]*\])?(?:\.[A-Za-z_][\w-]*|\[[^\]]*\])+$/;
+
+/** Every `${...}` span in a template, as `attr()` finds them. */
+const SPANS = /\$\{(?:[^{}]|\{[^{}]*\})*\}/g;
+
+/**
+ * Whether a key-like argument (`kms_master_key_id`) is set to something.
+ *
+ * - absent, or `null`: `absent`.
+ * - a literal: `known`, with the string (`""` is a value, and a rule decides
+ *   what an empty key means).
+ * - an attribute of a managed resource or data source (`aws_kms_key.x.arn`):
+ *   `known` and non-empty. The provider computes a key's id or ARN; it is
+ *   never the empty string, so the key is set whatever its value turns out to
+ *   be.
+ * - a template with literal text (`"alias/${var.env}-sns"`): `known` and
+ *   non-empty, for the same reason.
+ * - anything else (`var.kms_key`, `local.key`, a conditional, a function
+ *   call): `unknown`. A variable can be `null` or `""`.
+ */
+export function readKeySet(body: BlockBody, name: string): Read<string> {
+  const a = attr(body, name);
+  if (a.kind === "absent") return { kind: "absent" };
+  if (a.kind === "literal") {
+    return typeof a.value === "string"
+      ? { kind: "known", value: a.value }
+      : { kind: "unknown", reason: `\`${name}\` is not a string (${JSON.stringify(a.value)})` };
+  }
+  const raw = String(a.raw);
+  if (a.kind === "template") {
+    if (raw.replace(SPANS, "").length > 0) return { kind: "known", value: raw };
+    return { kind: "unknown", reason: describe(name, a.raw, a.refs, "template") };
+  }
+  const expr = (a.refs?.[0] ?? "").trim();
+  const m = OBJECT_ATTRIBUTE.exec(expr);
+  if (m && !VALUE_ROOTS.has(m[1])) return { kind: "known", value: raw };
+  return { kind: "unknown", reason: describe(name, a.raw, a.refs, "reference") };
+}
+
+/**
+ * Whether an argument that names a source (`snapshot_identifier`,
+ * `replicate_source_db`) or a nested block (`restore_to_point_in_time`) is
+ * given. The provider reads these with `GetOk`, so a literal `""` is the same
+ * as leaving the argument out; anything else, a reference included, is given.
+ */
+export function isGiven(body: BlockBody, name: string): boolean {
+  const a = attr(body, name);
+  if (a.kind === "absent") return false;
+  if (a.kind === "literal") {
+    if (a.value === "" || a.value === false) return false;
+    if (Array.isArray(a.value)) return a.value.length > 0;
+  }
+  return true;
+}
+
+/** The bodies of a nested block, re-exported for the rule files. */
+export { nestedBodies };
+
+/** A finding the literal proves. */
+export function finding(
+  checkId: string,
+  severity: "error" | "warning",
+  block: TerraformBlock,
+  message: string,
+): PostSynthDiagnostic {
+  return { checkId, severity, message: `"${block.address}" ${message}`, entity: block.key, lexicon: "terraform" };
+}
+
+/**
+ * The one `info` diagnostic a rule emits when it cannot read the value it
+ * needs. The message starts `Not determined:`, as #2284 fixed for TF030-TF037.
+ */
+export function notDetermined(checkId: string, block: TerraformBlock, reason: string, tail: string): PostSynthDiagnostic {
+  return {
+    checkId,
+    severity: "info",
+    message: `Not determined: "${block.address}" ${reason}. ${tail}`,
+    entity: block.key,
+    lexicon: "terraform",
+  };
+}